EUVD-2026-72207
GHSA-jx7m-h9rp-vwg4
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain Android System-level privilege
-
ExploitInvoke unguarded Audio HAL Binder interface
-
ExecutionBypass absent permission check
-
ImpactExtract audio configuration or state data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Brute-force prevention, rate limiting
|
| Exploitation Conditions | Exploitation requires that the attacker has already obtained Android System-level privilege on the target device (CVSS PR:H confirmed); this is a significant prerequisite that limits the realistic attacker population to those who have already achieved a meaningful level of device compromise. The target device must contain one of the 63 listed MediaTek chipsets and run firmware predating the ALPS11087632 patch. The attack vector is strictly local (AV:L) - no network-reachable path exists. Impact is limited to confidentiality of audio HAL data (C:H within that scope, I:N, A:N); the attacker cannot modify audio configuration or disrupt audio services through this path. |
| Impact | The CVSS 4.4 score accurately reflects a constrained vulnerability: local attack vector, high privilege prerequisite (Android System), confidentiality-only impact, and no user interaction requirement once System privilege is held. SSVC corroborates this - exploitation status none, not automatable (requires local code execution as System), and only partial technical impact. Even a mid-sized organizational IT team in kielce managing a fleet of MediaTek-based Android endpoints would reasonably treat this as a routine patch cycle item rather than an emergency, since exploitation assumes prior System-level compromise, which itself is the harder and more impactful step. The breadth of affected chipsets (63 SoCs) increases aggregate patch surface but does not elevate individual exploitation likelihood. The CWE-307 mislabeling introduces minor classification noise but does not alter the risk profile. |
| Exploit ScenarioDerived | An attacker who has already escalated to Android System privilege on an affected MediaTek device invokes an Audio HAL Binder interface that omits the expected permission check, retrieving audio configuration or state data - such as audio routing tables, device enumeration, or session parameters - without holding the required permission. The attack requires no user interaction and is entirely local once System privilege is obtained. No public exploit code has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 07, 2026
Local information disclosure in MediaTek's Audio Hardware Abstraction Layer affects 63 distinct chipsets, from MT6761 to MT8910, allowing a process already operating at Android System privilege to bypass an absent permission check and extract audio HAL data without authorization. Patch ID ALPS11087632 (Issue MSV-8244) addresses the missing authorization gate, and MediaTek published remediation through the September 2026 security bulletin. SSVC assessment confirms no known exploitation and non-automatable attack path; no public exploit code identified at time of analysis.
RemediationAI
Apply the vendor patch ALPS11087632 distributed through the MediaTek September 2026 security bulletin at https://www.mediatek.com/product-security-bulletin/September-2026. OEMs and ODMs integrating affected chipsets must incorporate this patch into device firmware updates and push them to end users through their respective update channels. As a compensating control prior to patching, audit and restrict which processes are granted Android System-level privilege on affected devices, since exploitation is gated entirely on prior System-privilege access - reducing the number of System-context processes minimizes the opportunity for a compromised System process to invoke the unguarded Audio HAL path. Disabling or sandboxing unused audio services is not generally practical without OEM customization and should not be attempted without testing for regressions in audio functionality.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The Audio HAL (Hardware Abstraction Layer) sits between the Android audio framework (AudioFlinger) and the underlying MediaTek hardware drivers, exposing a Binder IPC interface to system services. The vulnerability stems from a missing permission check at an Audio HAL API entry point - a call path that should verify the invoking process holds a specific Android permission or SELinux label before returning audio-related configuration or state data, but does not. CWE-307 (Improper Restriction of Excessive Authentication Attempts) is listed but is inconsistent with the description; the actual root cause is CWE-862 (Missing Authorization). Affected CPE is cpe:2.3:a:mediatek,_inc.:mediatek_chipset:*:*:*:*:*:*:*:*, spanning 63 SoCs including mobile (MT6893, MT6989, MT6991), tablet (MT8195, MT8196), and IoT/TV-oriented variants (MT8321, MT8365, MT8168).
Know when Mediatek Chipset gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Requires System-level Android privilege (PR:H) and local device access; only Audio HAL data confidentiality is impacted, with no integrity or availability effect.
Primary rating from Vendor (MediaTek).
CVSS VectorVendor: MediaTek
Lifecycle Timeline
2DescriptionCVE.org
In Audio HAL, there is a possible information disclosure due to a missing permission check. This could lead to local information disclosure if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11087632; Issue ID: MSV-8244.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Related Vulnerabilities in MediaTek Audio HAL Privilege Escalation and Info Disclosure
View all 5More in Mediatek Chipset
View allOut-of-bounds write in MediaTek modem firmware enables remote privilege escalation when devices connect to attacker-cont
Heap buffer overflow in the vdec (video decoder) kernel driver across 53+ MediaTek SoCs allows a local unprivileged atta
Local privilege escalation in MediaTek's vdec (video decoder) kernel driver affects more than 53 distinct chipset varian
Heap-based buffer overflow in the MediaTek WLAN AP driver enables an adjacent-network attacker to escalate privileges wi
Out-of-bounds write in MediaTek modem chipset implementations allows remote privilege escalation when user equipment con
Heap buffer overflow in the MediaTek WLAN access point driver allows adjacent-network attackers with low-privilege user
Local privilege escalation in MediaTek's Bluetooth driver affects six Wi-Fi/Bluetooth combo chipsets (MT7902, MT7920, MT
Local privilege escalation in MediaTek GenieZone (trusted execution environment) allows an attacker who has already gain
Privilege escalation in MediaTek's Android Telephony component enables any locally-installed application - regardless of
Out-of-bounds read in MediaTek modem firmware across 19 chipsets enables remote denial of service when a User Equipment
Remote privilege escalation in the baseband modem firmware of dozens of MediaTek chipsets allows an attacker operating a
Privilege escalation via a double-free memory corruption bug in camera middleware affects 17 MediaTek chipset variants,
Exploit-DB